The facts
The Office of the Comptroller of the Currency issued consent order AA-ENF-2026-46, dated Oct 8, 2026, against American Express National Bank of Sandy, Utah. The Bank neither admits nor denies the findings. According to the order, American Express National Bank is one of the largest credit and charge card issuers in the United States by transaction volume, but it "has not established and maintained a reasonably designed BSA/AML compliance program." It has "systemic internal control gaps" and "weak independent testing and BSA/AML training for employees and directors."
The OCC found violations of the bank's BSA/AML program, suspicious activity report filing, customer due diligence, and customer identification program requirements. The bank's risk assessment was "not appropriately tailored to its business activities because it focused on the risks in the Bank’s relatively narrow demand deposit account products and services and insufficiently on the risks in its more dominant credit and charge card products", the order says. Its customer identification procedures "had substantial gaps and did not enable the Bank to form a reasonable belief that it knew the true identity of each customer." Its suspicious activity monitoring had "systemic breakdowns" producing "untimely, missed, or incomplete SARs". The bank also had not supported the program with "appropriate resources, including staffing with commensurate skills, expertise, and training".
The worst part: "From approximately June 2014 to approximately May 2025, the Bank processed approximately $13 billion in suspected TBML activity, including a combination of suspicious card charges and associated repayments of those card charges, and including in certain instances through accounts associated with Bank insiders." The bank did report some suspicious activity periodically, but, the order says, it "lacked the internal controls and monitoring capabilities to timely identify and report the full scope of this activity." The OCC called the violations "part of a pattern of misconduct" that caused more than a minimal loss to the Bank. The bank has begun corrective action.
Our take
Eleven years. Thirteen billion dollars. And American Express’s big-brain strategy for stopping financial crime was to hire a bunch of underqualified dickheads to stare at the wrong half of their own business. That’s the real takeaway from this consent order, you absolute fucking clowns. You’re a credit card company, and your "risk assessment" spent over a decade laser-focused on your "relatively narrow" deposit accounts - which nobody gives a shit about - while your main fucking product, the cards, became a slip-n-slide for billions in dirty money. That’s not a compliance failure; that’s a lobotomy performed with a rusty spork.
And let’s talk about these "Bank insiders" whose accounts got used. That’s regulator-speak for some cunt who works here. So not only could Amex not spot a criminal from a hole in the ground - their own customer ID checks were so piss-poor they couldn’t "form a reasonable belief" they knew who their customers were - but their own staff might have been part of the fucking plumbing. The bank’s idea of "staffing with commensurate skills" was apparently to hire people whose expertise was in making fucking coffee.
They processed $13 billion in suspected TBML activity through card charges and repayments. That’s a systematic, decade-long car wash for crime, and their monitoring had "systemic breakdowns." Translation: their fraud team was so busy jerking off that billions in shady transactions sailed right past their empty fucking desks. The OCC calls this a "pattern of misconduct." No shit. It’s a pattern of being a useless, greedy pack of assholes who cared more about your annual fee than preventing their own product from being a weapon for financial crooks.
Now they’ve "begun corrective action." Great. Maybe start by firing every incompetent prick who thought this was acceptable and selling your Don’t Leave Home Without It slogan to a fucking laundry service. Because that’s all your card was good for: cleaning money.
